brindle 0.3.13__tar.gz → 0.3.14__tar.gz

{brindle-0.3.13 → brindle-0.3.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.13
+Version: 0.3.14
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.13`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.14`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.13 → brindle-0.3.14}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.13`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.14`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.13 → brindle-0.3.14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.13"
+version = "0.3.14"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/agents.py

@@ -2937,8 +2937,13 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     where =f" (branch `{ws.branch}`, workspace {ws.id})" if ws else ""
     tool = "submit_review" if agent.mode == "review" else "report_result"
     who = "Reviewer" if agent.mode == "review" else "Worker"
+    # A fix round's worker reported once already; the review's fixes are what's missing.
+    what = (f"stopped in a review fix round without committing or calling {tool} again "
+            "(it may have lost its brindle connection)"
+            if agent.pipeline == "fixing" and agent.result is not None
+            else f"stopped without calling {tool}")
     body = (
-        f"{who} {agent.id}{where} stopped without calling {tool}, and won't be reminded "
+        f"{who} {agent.id}{where} {what}, and won't be reminded "
         f"again on its own. Check on it: workspace_diff to see what it did, send_message to "
         f"ask it to finish or report, or remove_workspace if the work is abandoned."
     )

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/cloud_credential.py

@@ -231,7 +231,7 @@ def hook_argv(argv0: str | None = None, python: str | None = None) -> list[str]:
         return [raw]
     interpreter = python or sys.executable
     _vet(interpreter, "the Python interpreter")
-    return [interpreter, "-m", "brindle"]
+    return [interpreter, "-P", "-m", "brindle"]    # -P: not a brindle/ in the hook's cwd
 
 
 def hook_command(cloud: str, org_id: str, argv0: str | None = None, python: str | None = None) -> str:

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/cull.py

@@ -266,19 +266,26 @@ def note_idle_unreported(db: DB, now: float, panes: dict[str, bool]) -> list[str
     A worker whose provider has no hook for a turn starting (Codex) stays
     'idle' from its first finished turn on, through any later turns, so it
     also needs a pane that has printed nothing for that long, and the spell
-    starts at its last output."""
+    starts at its last output.
+
+    A worker in a pipeline fix round already has a result from its first
+    report, so it counts as unreported while it hasn't reported again since
+    the review that asked for fixes (committing doesn't count), and its spell
+    starts no earlier than that review."""
     from brindle.providers import get_provider
 
     done = []
     owners = agents.pane_owners(db, panes)
     for a in db.list_agents():
+        fix_round = _fix_round_since(db, a) if a.result is not None else None
         # Only these are ever told (a synchronous handoff's caller is waiting).
-        if (a.mode not in agents.FORWARDING_MODES or not a.parent_id or a.result is not None
+        if (a.mode not in agents.FORWARDING_MODES or not a.parent_id
+                or (a.result is not None and fix_round is None)
                 or a.dismissed_at is not None or a.status != "idle"
                 or not agents.runs_process(a) or not agents.same_server(a, panes)
                 or not agents.is_alive(a, panes) or not agents.owns_pane(db, a, owners)):
             continue
-        since = a.status_since or a.created_at
+        since = max(a.status_since or a.created_at, fix_round or 0)
         provider = get_provider(a.provider)
         if not (provider.uses_hooks and provider.announces_turns):
             last = tmux.window_activity(a.tmux_window, server=agents.server_of(a))
@@ -295,6 +302,16 @@ def note_idle_unreported(db: DB, now: float, panes: dict[str, bool]) -> list[str
     return done
 
 
+def _fix_round_since(db: DB, a: Agent) -> float | None:
+    """When the review that put a worker's branch in a fix round was given,
+    if the worker is still in that round, whether or not it has committed
+    since; None otherwise. Reporting again moves the branch on to 'reviewing'."""
+    if a.pipeline != "fixing":
+        return None
+    review = db.last_review(a.workspace_id)
+    return review.created_at if review is not None else None
+
+
 # How long a worker no hook reports on (Codex) may show nothing new before its
 # supervisor is told. Such a CLI can sit on a startup error forever: signed in
 # without a plan that includes it, say (issue #42).

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/mcp_server.py

@@ -10,7 +10,7 @@ import time
 
 from mcp.server.mcpserver import MCPServer
 
-from brindle import agents, autopilot, codex_hook, cost_estimate, git, history, pipeline, policy, quota, repos, savings, sessions, tasks, workspaces
+from brindle import agents, autopilot, codex_hook, cost_estimate, git, history, pipeline, policy, quota, repos, savings, sessions, tasks, upgrade, workspaces
 from brindle.pro import brief_learning
 from brindle.config import load_repo_config
 from brindle.db import DB, Agent, Workspace
@@ -36,6 +36,9 @@ mcp = MCPServer(
         "`list_repos` shows them, and `repo=<alias>` on handoff/assign (and on the workspace "
         "tools) puts a worker in that repo, with that repo's own checks, review and merge."
     ),
+    # Loads all of brindle up front, so an upgrade under this long-lived server
+    # leaves it serving the version it started with (see upgrade.py).
+    lifespan=upgrade.preloaded,
 )
 
 

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/native/permissions.py

@@ -98,75 +98,140 @@ def uncovered_part(specs: list[str | None], command: str, cd_root: str | None =
     Neither is what split_commands can't split (an unclosed quote, a
     heredoc, a redirection that writes a file): it counts as uncovered. With
     ``cd_root``, a ``cd`` whose target is inside that directory is covered
-    too (``cd sub && pytest`` from a worker's own worktree)."""
+    too (``cd sub && pytest`` from a worker's own worktree), but only before
+    any other command: the target is checked now and entered later, and what
+    runs first (``git checkout``, a build) may swap a directory on the way
+    for a symlink out. The residual risk is a process running alongside
+    (something this agent backgrounded earlier) doing that swap between this
+    check and the cd; _cd_inside refuses symlinks so it at least has to
+    replace a directory, not just retarget a link."""
     command = command.strip()
     if not command or "$(" in command or "`" in command:
         return command or "(empty)"
-    parts = split_commands(command)
-    if not parts:
+    parsed = _simple_commands(command)
+    if not parsed:
         return command
-    cwd = cd_root
-    for part in parts:
-        if cd_root and _cd_inside(part, cwd, cd_root) is not None:
-            cwd = _cd_inside(part, cwd, cd_root)
-            continue
-        if not any(_covers(spec, part) for spec in specs if spec):
-            return part
+    # Where the shell may be: a cd can fail, or be skipped after a failure,
+    # so every later cd must stay inside from each place it may start.
+    reached = {cd_root} if cd_root else set()  # anywhere, once a list stops
+    here = set(reached)                         # where this command starts
+    before = ";"
+    ran = False                                 # a command other than cd has
+    for words, after in parsed:
+        if cd_root and words[0] == "cd":
+            # In a pipe or backgrounded, it changes a subshell's directory;
+            # after ||, whether it ran says nothing about what runs next.
+            if ran or before in ("||", "|", "|&") or after in ("|", "|&", "&"):
+                return _joined(words)
+            landed = {_cd_inside(words, cwd, cd_root) for cwd in here}
+            if None in landed or len(reached | landed) > 32:
+                return _joined(words)
+            reached |= landed
+            if after == "&&":  # what follows runs only if this cd worked
+                here = landed
+        elif not any(_covers(spec, words) for spec in specs if spec):
+            return _joined(words)
+        else:
+            ran = True
+        if after != "&&":
+            here = set(reached)
+        before = after
     return None
 
 
-def _cd_inside(part: str, cwd: str | None, root: str) -> str | None:
-    """The directory ``part`` (a ``cd`` command) would land in, if that is
-    ``root`` or below it; None for any other command or target."""
-    tokens = part.split()
-    if len(tokens) != 2 or tokens[0] != "cd" or tokens[1].startswith("-") or "$" in tokens[1]:
-        return None  # a variable expands at run time to who knows where
+def _cd_inside(words: list[str], cwd: str, root: str) -> str | None:
+    """Where ``cd`` with ``words`` lands from ``cwd`` (the logical path, as
+    $PWD has it), if that is ``root`` or below it; None for any other target.
+    No ``-`` option, ``~`` (``~-`` is $OLDPWD, ``~1`` the dir stack) or glob,
+    and the same place whether the shell resolves ``..`` logically (bash's
+    default: ``link/..`` is back where it started) or physically. Below
+    ``root`` it must be an existing directory reached through no symlink:
+    one, even pointing inside, can be retargeted before the cd runs."""
     import os
 
-    # realpath on both sides: a symlink inside the worktree may point out of
-    # it, and the worktree itself may sit under one (/tmp on macOS).
-    target = os.path.realpath(os.path.join(cwd or root, os.path.expanduser(tokens[1])))
-    real_root = os.path.realpath(root)
-    return target if target == real_root or target.startswith(real_root + os.sep) else None
+    target = words[1] if len(words) == 2 else ""
+    if not target or target.startswith(("-", "~")) or any(c in target for c in "*?[{"):
+        return None
+    root = os.path.normpath(root)
+    logical = os.path.normpath(os.path.join(cwd, target))
+    if logical != root and not logical.startswith(root.rstrip(os.sep) + os.sep):
+        return None
+    path = root     # which itself may sit under a symlink (/tmp on macOS)
+    for part in os.path.relpath(logical, root).split(os.sep):
+        path = os.path.join(path, part)
+        if os.path.islink(path):
+            return None
+    if not os.path.isdir(logical):
+        return None
+    # The way there may pass through one (``link/..``), which cd -L skips
+    # and cd -P follows.
+    physical = os.path.realpath(os.path.join(os.path.realpath(cwd), target))
+    return logical if os.path.realpath(logical) == physical else None
 
 
-def _covers(spec: str, part: str) -> bool:
+def _covers(spec: str, words: list[str]) -> bool:
+    """Word by word, so a quoted ``'git status'`` (one word, a command of
+    that name) or ``python "-m pytest"`` isn't ``git status`` or ``python -m
+    pytest``."""
     if spec.endswith(":*"):
-        prefix = spec[:-2].strip()
-        return part == prefix or part.startswith(prefix + " ")
-    return part == spec.strip()
+        prefix = spec[:-2].split()
+        return bool(prefix) and words[:len(prefix)] == prefix
+    return words == spec.split()
+
+
+def _joined(words: list[str]) -> str:
+    """``words`` as one line for a person or a deny rule to read: split at
+    any whitespace, even inside a word, so an empty or spaced word (``task
+    test "" secret``) can't slip past an exact deny on ``task test secret``."""
+    return " ".join(" ".join(words).split())
 
 
 def split_commands(command: str) -> list[str]:
     """The simple commands joined by a control operator (``&&``, ``||``,
     ``;``, ``;;``, ``|``, ``|&``, ``&`` or a newline), each re-joined from
-    its words (so spacing and quoting don't matter). A redirection is dropped
-    when it's harmless: output to /dev/null, an fd dup (``2>&1``), input from
-    a file. Anything else gives an empty list, which nothing matches: an
-    unclosed quote, other output redirection, a heredoc (``<<``), process
-    substitution (``<(...)``), a subshell or any other operator."""
+    its words (so spacing and quoting don't matter; see _joined), or an
+    empty list for what _simple_commands can't read."""
+    return [_joined(words) for words, _ in _simple_commands(command) or []]
+
+
+def _simple_commands(command: str) -> list[tuple[list[str], str]] | None:
+    """Each simple command's words (quotes removed) with the control operator
+    after it ("" for the last). A redirection is dropped when it's harmless:
+    output to /dev/null, an fd dup (``2>&1``), input from a file. Anything
+    else gives None: an unclosed quote, other output redirection, a heredoc
+    (``<<``), process substitution (``<(...)``), a subshell or any other
+    operator, a command with no words (``; < x``, ``a ; ; b``) or a list
+    left open (``git status |``)."""
     tokens = _tokens(command)
     if tokens is None:
-        return []
-    parts, current = [], []
+        return None
+    out: list[tuple[list[str], str]] = []
+    words: list[str] = []
+    redirected = False
     i = 0
     while i < len(tokens):
         is_op, text = tokens[i]
         if not is_op:
-            current.append(text)
+            words.append(text)
         elif text in _SEPARATORS:
-            if current:
-                parts.append(" ".join(current))
-            current = []
+            if words:
+                out.append((words, text))
+                words, redirected = [], False
+            elif redirected or text != "\n":
+                return None
+            # else a blank line, or a newline continuing a && or |
         else:
             target = tokens[i + 1] if i + 1 < len(tokens) else (True, "")
             if target[0] or not _harmless_redirect(text, target[1]):
-                return []
+                return None
+            redirected = True
             i += 1
         i += 1
-    if current:
-        parts.append(" ".join(current))
-    return parts
+    if words:
+        out.append((words, ""))
+    elif redirected or not out or out[-1][1] in ("&&", "||", "|", "|&"):
+        return None
+    return out
 
 
 def _harmless_redirect(op: str, target: str) -> bool:
@@ -195,9 +260,10 @@ def _tokens(command: str) -> list[tuple[bool, str]] | None:
         if c in " \t\n" or c in _OPERATOR_CHARS:
             j = i + 1
             if c in _OPERATOR_CHARS:
-                while j < n and command[j] in _OPERATOR_CHARS:
-                    j += 1
-            op = command[i:j]
+                # \<newline> goes before the shell reads operators: &\<newline>> is &>
+                while j < n and (command[j] in _OPERATOR_CHARS or command.startswith("\\\n", j)):
+                    j += 1 if command[j] in _OPERATOR_CHARS else 2
+            op = command[i:j].replace("\\\n", "")
             if word is not None:
                 text = "".join(word)
                 fd = op[0] in "<>" and not quoted and text.isascii() and text.isdigit()
@@ -246,12 +312,14 @@ def _tokens(command: str) -> list[tuple[bool, str]] | None:
 
 
 def _expands(command: str, i: int) -> bool:
-    """Whether the ``$`` at ``i`` starts quoting or an expansion with its own
-    parsing (``$'``, ``$"``, ``${``, ``$(``, ``$[``), once the shell has
-    deleted the line continuations (\\<newline>) after it."""
+    """Whether the ``$`` at ``i`` starts quoting or any expansion (``$'``,
+    ``$"``, ``${``, ``$(``, ``$[``, ``$VAR``, ``$_``, ``$1``, ``$@``...),
+    once the shell has deleted the line continuations (\\<newline>) after
+    it: what a parameter holds is only known at run time (``$unset`` is no
+    word at all)."""
     if command[i] != "$":
         return False
     k = i + 1
     while command.startswith("\\\n", k):
         k += 2
-    return k < len(command) and command[k] in "'\"{(["
+    return k < len(command) and (command[k] in "'\"{([_@*#?$!-" or command[k].isalnum())

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/permissions.py

@@ -850,7 +850,10 @@ def deny_in_parts(req: Request, *, checks: list[str] | None = None,
         return None
     denies = [rule for rule in rules if rule.decision == "deny"]
     for words in _segments(req.command):
-        decision = decide(replace(req, command=" ".join(words)), checks=checks, rules=denies)
+        # Split even inside a word, as split_commands does: an empty or
+        # spaced word (task test "" secret) mustn't dodge an exact deny.
+        command = " ".join(" ".join(words).split())
+        decision = decide(replace(req, command=command), checks=checks, rules=denies)
         if decision.decision == "deny":
             return decision
     return None

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/profiles.py

@@ -40,6 +40,47 @@ from brindle.config import CONFIG_DIR, brindle_home, user_profiles_dir
 
 log = logging.getLogger(__name__)
 
+_BUILTIN_PACKAGES = ("brindle.builtin_agents", "brindle.builtin_rules")
+# The built-in profiles and rule packs as freeze_builtins() read them, by
+# package and then name (``security/backend``), for a long-lived process that
+# must not see an upgrade replace those files under it. None: read the files.
+_frozen: dict[str, dict[str, str]] | None = None
+
+
+def _builtin_files(package: str):
+    """(name, file) for each ``.md`` file under ``package``, the name being its
+    path below it without ``.md``."""
+    def walk(entry, prefix: str):
+        for child in entry.iterdir():
+            if child.is_dir():
+                yield from walk(child, f"{prefix}{child.name}/")
+            elif child.name.endswith(".md"):
+                yield f"{prefix}{child.name[:-3]}", child
+
+    return walk(resources.files(package), "")
+
+
+def freeze_builtins() -> None:
+    """Read every built-in profile and rule pack into memory, and serve them
+    from there from now on (see brindle.upgrade)."""
+    global _frozen
+    _frozen = {package: {name: f.read_text(encoding="utf-8") for name, f in _builtin_files(package)}
+               for package in _BUILTIN_PACKAGES}
+
+
+def _builtin_text(package: str, name: str) -> str | None:
+    if _frozen is not None:
+        return _frozen[package].get(name)
+    *dirs, last = name.split("/")
+    f = resources.files(package).joinpath(*dirs, f"{last}.md")
+    return f.read_text(encoding="utf-8") if f.is_file() else None
+
+
+def _builtin_names(package: str) -> list[str]:
+    if _frozen is not None:
+        return list(_frozen[package])
+    return [name for name, _ in _builtin_files(package)]
+
 
 class ProfileError(ValueError):
     """A profile file that can't be used as written: an ``extends`` cycle, or
@@ -389,9 +430,9 @@ def _read(name: str, repo_root: str | None) -> tuple[str, str] | None:
             return f.read_text(encoding="utf-8"), str(f)
     if org is not None:
         return org.text, f"org profile {name}"
-    builtin = resources.files("brindle.builtin_agents").joinpath(f"{name}.md")
-    if builtin.is_file():
-        return builtin.read_text(encoding="utf-8"), f"built-in profile {name}"
+    builtin = _builtin_text("brindle.builtin_agents", name)
+    if builtin is not None:
+        return builtin, f"built-in profile {name}"
     return None
 
 
@@ -483,9 +524,9 @@ def _read_pack(name: str, repo_root: str | None) -> tuple[str, str] | None:
             return f.read_text(encoding="utf-8"), str(f)
     if org is not None:
         return org.text, f"org rule pack {name}"
-    builtin = resources.files("brindle.builtin_rules").joinpath(*parts[:-1], f"{parts[-1]}.md")
-    if builtin.is_file():
-        return builtin.read_text(encoding="utf-8"), f"built-in rule pack {name}"
+    builtin = _builtin_text("brindle.builtin_rules", name)
+    if builtin is not None:
+        return builtin, f"built-in rule pack {name}"
     return None
 
 
@@ -561,17 +602,7 @@ def _required_packs(names: list[str]) -> list[RulePack]:
 
 def list_rule_packs(repo_root: str | None = None) -> list[str]:
     """Every rule pack name that would load, the nearest definition winning."""
-    names: set[str] = set()
-    builtin = resources.files("brindle.builtin_rules")
-
-    def walk(entry, prefix: str) -> None:
-        for child in entry.iterdir():
-            if child.is_dir():
-                walk(child, f"{prefix}{child.name}/")
-            elif child.name.endswith(".md"):
-                names.add(f"{prefix}{child.name[:-3]}")
-
-    walk(builtin, "")
+    names = set(_builtin_names("brindle.builtin_rules"))
     names.update(_org_names("pack"))
     for d in _rule_dirs(repo_root):
         if d.is_dir():
@@ -625,10 +656,7 @@ def profile_rules_for(name: str, repo_root: str | None = None):
 def profile_names(repo_root: str | None = None) -> list[str]:
     """Every profile file name (without ``.md``) in the lookup order's
     directories and the built-ins, each once."""
-    names: set[str] = set()
-    for entry in resources.files("brindle.builtin_agents").iterdir():
-        if entry.name.endswith(".md"):
-            names.add(entry.name[:-3])
+    names = set(_builtin_names("brindle.builtin_agents"))
     names.update(_org_names("profile"))
     for d in _search_dirs(repo_root):
         if d.is_dir():

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/providers.py

@@ -36,14 +36,17 @@ def brindle_invocation() -> list[str]:
     """argv that re-enters this same brindle install, independent of PATH.
     A brindle run from a worktree's venv (developing brindle with brindle)
     would write that venv's python into hooks that outlive the worktree, so
-    the installed ``brindle`` is used instead when there is one."""
+    the installed ``brindle`` is used instead when there is one. ``-P``: these
+    run from inside worktrees (hooks, a re-exec'd sidebar), and ``-m`` would
+    otherwise put the cwd first on sys.path, so a ``brindle/`` there would be
+    imported instead of the install."""
     if _in_worktree(sys.executable):
         # Past every worktree's own bin (``uv run`` puts it first on PATH).
         for directory in os.environ.get("PATH", "").split(os.pathsep):
             installed = shutil.which("brindle", path=directory) if directory else None
             if installed and not _in_worktree(installed):
                 return [installed]
-    return [sys.executable, "-m", "brindle"]
+    return [sys.executable, "-P", "-m", "brindle"]
 
 
 def mcp_server_spec(agent_id: str) -> dict:

{brindle-0.3.13 → brindle-0.3.14}/src/brindle/signin_pause.py

@@ -25,7 +25,8 @@ status``). Antigravity and gateway routes can't be verified and are skipped.
   account.
 
 State is ``$BRINDLE_HOME/signin-pause.json`` (0600): which agents were paused
-and why, and the identity each launched under. Identities are ids (Claude org,
+and why, the identity each launched under, and the warnings already given (so
+another sweeping process doesn't repeat one). Identities are ids (Claude org,
 AWS account and role, GCP project, Azure subscription), never tokens.
 """
 
@@ -37,7 +38,7 @@ import os
 import time
 from dataclasses import dataclass
 
-from brindle import agents, company_identity, config
+from brindle import agents, company_identity, company_login, config
 
 log = logging.getLogger(__name__)
 
@@ -45,19 +46,18 @@ INTERVAL = 30.0
 STATE_FILE = "signin-pause.json"
 NAMES = {"claude": "Claude", "codex": "Codex"}
 CLOUD_ROUTES = ("bedrock", "vertex", "foundry")
+ROUTED = CLOUD_ROUTES + ("gateway",)   # routes whose env, not the person's sign-in, picks the account
 # The reason of an agent paused with no identity to come back under: never auto-resumed.
 NO_IDENTITY = "paused at sign-out; resume it yourself once you've checked the account"
 
 _last = 0.0
 _cloud: dict[str, tuple[tuple, "Check"]] = {}   # route -> (fingerprint, determined answer)
-_warned: set[tuple[str, str]] = set()
 
 
 def reset() -> None:
     global _last
     _last = 0.0
     _cloud.clear()
-    _warned.clear()
 
 
 @dataclass
@@ -81,7 +81,7 @@ def _load() -> dict:
     except (OSError, ValueError):
         got = {}
     got = got if isinstance(got, dict) else {}
-    for key in ("paused", "identity", "different"):
+    for key in ("paused", "identity", "different", "warned"):
         if not isinstance(got.get(key), dict):
             got[key] = {}
     return got
@@ -116,10 +116,7 @@ def check(provider: str, cache: bool = False) -> tuple[Check, bool] | None:
         return _from(company_identity.codex_identity(cache)), False
     if provider != "claude":
         return None
-    got = company_identity._setup()
-    org_id, setup = got if got else (None, None)
-    claude = setup.claude if setup else None
-    enforce = bool(setup and setup.enforce)
+    org_id, claude, enforce = _claude_setup(company_identity._setup())
     route = claude.route if claude is not None else None
     if route == "gateway":
         return None
@@ -138,6 +135,20 @@ def check(provider: str, cache: bool = False) -> tuple[Check, bool] | None:
     return res, enforce
 
 
+def _claude_setup(got) -> tuple[str | None, object, bool]:
+    """(org id, the ``ClaudeSetup`` Claude's panes run under, whether the policy
+    enforces) for ``got``, an (org id, ``AgentSetup``) or None. A cloud or gateway
+    route whose env no pane gets (``company_login.route_in_use``: not stored by
+    company login, not enforced) leaves Claude on the person's own sign-in, which
+    is what's checked then. A login route has no env: its policy always applies."""
+    org_id, setup = got if got else (None, None)
+    claude = setup.claude if setup else None
+    if (claude is not None and claude.route in ROUTED
+            and not company_login.route_in_use(org_id, setup)):
+        claude = None
+    return org_id, claude, bool(setup and setup.enforce)
+
+
 def _from(ident) -> Check:
     if not ident.determined:
         return Check("undetermined", line=ident.line)
@@ -225,20 +236,31 @@ def run(db) -> list[str]:
     return done
 
 
-def _warn_once(db, provider: str, key: str, text: str, agent_list) -> list[str]:
-    if (provider, key) in _warned:
+def _warn_once(db, state, provider: str, key: str, text: str, agent_list) -> list[str]:
+    """Tell once per spell of the same state. Kept in the state file, since every
+    sweeping process (each pane's watcher, the CLI) starts with no memory of it."""
+    warned = state["warned"].get(provider)
+    if not isinstance(warned, list):
+        warned = state["warned"][provider] = []
+    if key in warned:
         return []
-    _warned.add((provider, key))
+    warned.append(key)
     _tell(db, agent_list, text)
     return [f"warned: {text}"]
 
 
+def _unwarn(state, provider: str, prefix: str) -> None:
+    warned = state["warned"].get(provider)
+    if isinstance(warned, list):
+        warned[:] = [k for k in warned if not (isinstance(k, str) and k.startswith(prefix))]
+
+
 def _handle(db, state, provider, running, res: Check, enforce: bool) -> list[str]:
     name = NAMES[provider]
     if res.kind == "undetermined":
-        return _warn_once(db, provider, "undetermined",
+        return _warn_once(db, state, provider, "undetermined",
                           f"{name}'s sign-in can't be verified ({res.line}); agents keep running.", running)
-    _warned.discard((provider, "undetermined"))
+    _unwarn(state, provider, "undetermined")
     if res.kind == "signed_out":
         return _pause(db, state, provider, running, f"{name} signed out",
                       f"{name} is signed out. Run `brindle login` or `brindle doctor --fix` "
@@ -253,10 +275,9 @@ def _handle(db, state, provider, running, res: Check, enforce: bool) -> list[str
                       "enforces it. Fix it and they resume on their own.")
     out: list[str] = []
     if res.problem:
-        out += _warn_once(db, provider, "mismatch:" + res.problem, f"{res.problem}.", running)
+        out += _warn_once(db, state, provider, "mismatch:" + res.problem, f"{res.problem}.", running)
     else:
-        for k in [k for k in _warned if k[0] == provider and k[1].startswith("mismatch:")]:
-            _warned.discard(k)
+        _unwarn(state, provider, "mismatch:")
     return out + _resume(db, state, provider, res)
 
 
@@ -264,11 +285,10 @@ def _expected() -> str | None:
     """The identity the org's agent_setup expects Claude to run as (or the
     saved self-serve setup's); None when there's nothing to check against."""
     try:
-        got = company_identity._setup() or company_identity._local_setup()
+        claude = _claude_setup(company_identity._setup() or company_identity._local_setup())[1]
     except Exception:  # noqa: BLE001 - an unreadable setup means nothing expected
         return None
-    setup = got[1] if got else None
-    return company_identity.expected_ident(setup.claude if setup else None)
+    return company_identity.expected_ident(claude)
 
 
 def _pause(db, state, provider, running, reason: str, advice: str) -> list[str]: